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IN THE CLAIMS: 




lease re-write the claims to read as follows: 



(Currently Amended) Apparatus for tightly-coupling hardware data encryption 
funb^ions with software-based protocol decode processing within a pipelined processor of 
a programmable processing engine in a network switch, the apparatus comprising: 
an\ncryption execution unit contained within the pipelined processor; 
an Ah\J contained within the pipelined processor; 
an instruction decode stage (ID stage), [ALU,] in response to reading an opcode 
[op-code], enablessthe encryption execution unit to read data from a memory shared by 
the ALU and the encry ption execution unit [pipelined processor], and for the encryption 
execution unit to process the data read from the shared memory; and 

a multiplexer to select as an output a result of processing by the encryption exe- 
cution unit rather than a resukof ALU processing. 



2. (Original) The apparatus of Claim 1 wherein the encryption execution unit is an en- 
cryption tightly coupled state machine (TCSMXunit that is selectively invoked within the 
pipelined processor. 
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(Currently Amended) The apparatus of Claim 2 A further comprising: 

2 \native encryption opcodes provided within an instruction set of the pipelined 

3 processor to enable selective access to the encryption TCSM unit by software. 



1 4. (Currently AmendedJsThe apparatus of Claim 3 A further comprising: 

2 a plurality of busses mternal to the pipelined processor and wherein a hardware 

3 portion of the interface allows the encryption TCSM unit to utilize the internal buses in 

4 response to decode processing ofNhe native encryption opcodes. 



1 5. (Currently Amended) The apparatus of Claim .4 , further comprising: [wherein] 

2 the pipelined processor is a microcontrollercore (TMC) processor having a 

3 multi-stage pipeline architecture that includes an instrtation fetch stage, an instruction 

4 decode stage, an execution stage and a memory write-back stage. 
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1 ^6. (Currently Amended) The apparatus of Claim 5 , further comprising: [wherein] 

2 \ the TMC processor further includes an arithmetic logic unit, at least one internal 

3 register^an instruction fetch and decode unit and the encryption TCSM unit organized as 

4 a data patnv 

1 7. (Currently Amended) i\he apparatus of Claim 5 wherein the encryption TCSM unit 

2 comprises! \ 

3 a data encryption standard (DES) functional component cooperatively coupled to 

4 a sub-key generation functional component. 

1 8. (Currently Amended) The apparatus of Claim V wherein the DES functional compo- 

2 nent comprises! \ 

3 state machine hardware used to execute each round of a DES function. 
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1 N?. (Currently Amended) The apparatus of Claim 7 a further comprising: 

2 Nhe sub-key generation functional component comprises state machine hardware 

3 that generates a sub-key as needed for each round of a DES function. 



1 / 10. (Currently Amended) \ A method for tightly-coupling hardware data encryption 

2 functions with software-based protocol decode processing within a pipelined processor of 

3 a programmable processing engine in a network switch, the method comprising the steps 

4 of: \ 

5 providing an encryption execution unit within the pipelined processor; 

6 providing an ALU within the pmelined processor; 

7 enabling, by an instruction decode stage (ID stage) [ALU] in response to read- 

8 ing an opcode [op-code], the encryption execution unit to read data from a memory 

9 shared by the ALU and the pipelined processor, and for the encryption execution unit to 

10 process the data read from the memory; and \ 

n selecting as output the result of processing x>y the encryption execution unit rather 

12 than selecting results from the ALU. \ 
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1 II. (Currently Amended) The method of Claim 1 0 A further comprising: 

2 \ having native encryption opcodes contained within an instruction set of the pipe- 

3 lined processor; and 

4 issmng the native encryption opcodes directly to the encryption execution unit to 

5 substantiallweduce encryption setup latency. 



1 12. (Currently Amended) The method of Claim 1 1 A further comprising: 

2 [the steps of, wherein the pipelined processor is a microcontroller core (TMC) processor 

3 having a multi-stage pipeline architecture that includes an instruction decode stage and an 

4 execution stage:] \ 

5 decoding the native encryption opcodes at the instruction decode stage; and 

6 in response to the step ordecoding, invoking the encryption execution unit to per- 

7 form encryption/decryption functions at the execution stage. 



1 13. (Currently Amended) The method of Claim 12 A further comprising: 

2 [the steps of, wherein the encryption/decryptiomfunctions are performed on plaintext 

3 stored at the network switch:] \ 

4 protocol processing of protocols contained iira [the] plaintext stored at the net- 

5 work switch to determine an appropriate encryption algorithm; 

6 upon determining the appropriate encryption algorithm, immediately starting an 

7 operation to fetch initial keys needed to perform the encryption/decryption functions; and 
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8 upon fetching the keys, providing the keys to the encryption execution unit within 

9 the TMC processor. 



1 14. (Currently Amended) The method of Claim 13 a further comprising: 

2 including)^ plurality of high-performance busses internal to the TMC processor; 

3 and 

4 accessing the\internal busses to simultaneously load an encryption key and store 

5 a previous encryption Vesult. 



1 15. (Previously Presented) The method of Claim 12 further comprising the step of, 

2 wherein the encryption execution unit is an encryption tightly coupled state machine 

3 (TCSM) unit: 

4 initializing the encryption l^CSM unit in response to execution of a first instruc- 

5 tion that defines the form of operation to be performed. 



1 16. (Original) The method of Claim 15 wherem the encryption TCSM unit comprises a 

2 data encryption standard (DES) functional component cooperatively coupled to a sub-key 

3 generation functional component and wherein the s(ep of initializing comprises the steps 

4 of: 

5 decoding a first portion of the first instruction t\j initialize the DES functional 

6 component; and 
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7 decoding a second portion of the first instruction to initialize the sub-key genera- 

8 tion functional component. 



1 17. (Original) The method of Claim 16 further comprising the step of: 

2 executing a second instruction having a micro-opcode field containing a native 

3 encryption opcode mat specifies loading an initial key from a memory into the sub-key 

4 generation functionalVomponent of the encryption TCSM unit. 



1 18. (Previously Presented) The\method of Claim 17 further comprising the step of: 

2 performing a DES function on a plaintext in response to execution of a third in- 

3 struction having a micro-opcode field containing a native encryption code that specifies 

4 loading of the plaintext into the DES Junctional component of the encryption TCSM unit 

5 and initiating DES operations; and 

6 upon completing the DES operations, storing a ciphertext result in an internal 

7 register coupled to the DES functional component. 



1 19. (Original) The method of Claim 1 8 further comprising the step of: 

2 executing a fourth instruction to store the ciphertext results contained in the inter- 

3 nal register to a location in the memory. 
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1 20. (Currently Amended) A programmable processing engine of a network switch com- 

2 prising: \ 

3 an irfout header buffer; 

4 an output header buffer; and 

5 a plurality of processing complex elements symmetrically arrayed into rows and 

6 columns that are embedded between the input header buffer and an output header buffer, 

7 each processing complex element comprising a microcontroller core having an encryp- 

8 tion tightly coupled stater machine (TCSM) unit that is selectively invoked in response to 

9 an instruction decode stagei (ID stage) [the microcontroller] reading an opcode [op-code]; 

10 and \ 

i i a selector to select an output from either the microcontroller OR the TCSM. 



1 21. (Currently Amended) \ A pipelined processor in a network switch, the processor 

2 comprising: \ 

3 an ALU internal to me processor responsive to a first set of opcodes; 

4 an encryption execution unit internal to the processor having an encryption tightly 

5 coupled state machine (TCSM) responsive to a second set of opcodes [,] ; 

6 an instruction decode stage (ID stage) to decode an opcode, the ID stage [ALU], 

7 in response to an [op-code] opcode of said second set of opcodes , transferring processing 

8 to the encryption execution unit [to process in response to said second set of opcodes]; 

9 a multiplexer to select output from the ALU OR from the encryption execution 

10 unit \ 
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(Currently Amended) The processor of Claim 21 , wherein the processor is a mi- 
cipcontroller core (TMC) processor and further comprises: 
an instruction fetch stage; 

[an instruction decode stage to decode an instruction fetched by the instruction 
fetch ^jtage;] 

execution stage to execute an [a decoded] instruction decoded by the ID stage : 



and 



a memory write-back stage to write a result of said execution stage to memory. 



23. (Currently Amended) The processor of Claim 21, further comprises: 
one or more internaTkregisters; 

a bus operatively connecting the one or more internal registers to both the ALU 
and the encryption execution unit; and 

a multiplexer having inputk from both the ALU and the encryption execution unit, 
the multiplexer outputting a selectecKinput. 



24. (Previously Presented) The processor ol^Claim 21, wherein the encryption TCSM 
unit comprises: 

a data encryption standard (DES) functional component cooperatively coupled to 
a sub-key generation functional component. 
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25\ (Previously Presented) The processor of Claim 24, wherein the DES functional 
component comprises: 

\state machine that executes each round of a DES function. 



26. (Previously ^Presented) The processor of Claim 24, wherein the sub-key genera- 
tion functional component comprises: 

a state machine ujat generates a sub-key as needed for each round of a DES 
function. 



27. (Currently Amended) A method fer providing encryption functions within a pipe- 
lined processor in a network switch, thernethod comprising the steps of: 

associating a first set of opcodes wiify an ALU internal to the processo r, the ALU 
performing protocol processing operations ; 

associating a second set of opcodes with W encryption execution unit internal to 
the processo r, the encryption execution unit performing encryption operations; 

[or having an encryption tightly coupled state machines (TCSM), wherein protocol proc- 
essing operations are performed by the ALU and encryption operations are performed by 
the encryption execution unit in response to said second se\of opcodes; and] 
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iecoding opcodes by an instruction decode stage (ID stage); 
transferring by the ID stage, in response to an opcode from said first set of op- 
codes, processing to the ALU; 

transferring by the ID stage [ALU], in response to an [op-code] opcode from said 
second set of opcodes , processing to the encryption execution unit 
[to process encryption operations in response to said second set of opcodes]; mid 

selecting output from the ALU OR from the encryption execution unit. 



28. (Previously Presented)\ The method of Claim 27, further comprises the step of: 
providing one or more internal registers; 

providing a bus operatively\:onnecting the one or more internal registers to both 
the ALU and the encryption execution unit; 

providing a multiplexer having inputs from both the ALU and the encryption exe- 
cution unit, the multiplexer outputting a selected input. 



29. (Previously Presented) The method of Claim 27 further comprising the step of: 

initializing the encryption TCSM unit in response to a first instruction that defines 
a form of operation to be performed. 
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1 \30. (Previously Presented) The method of Claim 29, wherein the step of initializing 

2 comprises the steps of: 

3 \ decoding a first portion of the first instruction to initialize a DES functional com- 

4 ponen\ and 

5 decoding a second portion of the first instruction to initialize a sub-key genera- 

6 tion functional component. 

1 31. (Previously Presented) The method of Claim 27, further comprising the steps of: 

2 executing a second instruction including an encryption opcode that specifies 

3 loading an initial key from a mtemory into a sub-key generation functional component of 

4 the TCSMunit. \ 

1 32. (Currently Amended) The method of Cl^im 27, further comprising the steps of: 

2 performing a DES function in response tcKexecution of a third instruction having a 

3 field containing an encryption opcode that specifiesvloading plaintext and initializing 

4 [initalizing] a DES operation. \ 
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1 ^3. (Currently Amended) A computer readable media, comprising: 

2 \ said computer readable media containing instructions for execution in a processor 

3 for tnb practice of the method of, 

4 providing a tightly-coupling hardware data encryption function with software- 

5 based protocol decode processing within a pipelined processor of a programmable proc- 

6 essing engine ima network switch; 

7 providing an encryption execution unit within the pipelined processor; 

8 providing an ALU within the pipelined processor; 

9 enabling, by an instruction decode stage (ID stage) [ALU] in response to read- 

10 ing an opcode [op-code] ,Nhe encryption execution unit to read data from a memory 

i i shared by the ALU and the pipelined processor, and for the encryption execution unit to 

12 process the data read from the memory; and 

13 selecting as output the result\pf processing by the encryption execution unit rather 

14 than selecting results from the ALU. \ 

1 /34. (Currently Amended) Electromagnetic signals propagating on a computer net- 

2 work, comprising: \ 

3 said electromagnetic signals carrying instructions for execution on a processor for 

4 the practice of the method of, \ 

5 providing a tightly-coupling hardware data encryption function with software- 

6 based protocol decode processing within a pipelined processor of a programmable proc- 

7 essing engine in a network switch; \ 

8 providing an encryption execution unit within the pipelined processor; 

14 \ 
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providing an ALU within the pipelined processor; 

enabling, by an instruction decode stage (ID stage) [ALU] in response to reading 
an opcode [op-ctode], the encryption execution unit to read data from a memory shared 
by the ALU and the pipelined processor, and for.the encryption execution unit to process 
the data read from me memory; and 

selecting as output the result of processing by the encryption execution unit rather 
than selecting results from the ALU. 



^. (Currently Amended) A router, comprising: 

a processor having an instruction decode stage (ID stage) [ALU] for processing 
opcodes \[op-codes] ; 
[and] 

an AL^I for performing protocol processing operations: 

a tightly coupled state machine (TCSM) for performing encryption processing; 

a shared mempry for providing data to either the ALU or the TCSM; 
the ID stage [ALU] , in response to reading an opcode [op-code], transferring 
processing to the TCSM, ah^ the TCSM performing encryption processing on data read 
from the shared memory; 

a selector to select as outpbt results from the ALU OR results from the TCSM. 




36. (Previously Presented) The apparatus of Claipi 35, further comprising: 
the selector is a multiplexer. 



37. (Previously Presented) The apparatus of Claim 35, further comprising; 
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2 the ALU selects whether the ALU or the TCSM reads data from the memory. 

1 38. (Previously Presented) The apparatus of Claim 35, further comprising: 

2 the TCSM performs DES data encryption standard encryption processing. 

1 39. (Previously PresentedV The apparatus of Claim 35, further comprising: 

2 a sub-key generatiomcomponent to provide a key to the TCSM. 

1 ^0. (Currently Amended) A methoaNfor operating a router, comprising: 

2 [providing a processor Waving an ALU for] 

3 processing [op-codes] opcodes bV an instruction decode stage (ID stage); [and] 

4 [a tightly coupled state machine (TCSM) for] 

5 performing encryption processing by a tightly coupled state machine (TCSM) : 

6 performing protocol processing by an ALU: 

7 reading data from a shared memory by erfcher the ALU or the TCSM; 

8 transferring processing by the ID stage [ALU], in response to reading an opcode 

9 [op-code,] to the TCSM, and the TCSM performing encryption processing on data read 

10 from the shared memory; \ 

i i selecting as output results from the ALU OR results from the TCSM. 



i 41 . (Previously Presented) The method of Claim 40, further comprising: 
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ising a multiplexer for selecting as output results from the ALU OR results from 



the TCSr 



42. (Currently Amended) The method of Claim 40, further comprising; 

selecting [by the ALU] whether the ALU or the TCSM reads data from the 
memory. 



43. (Previously Presented) The method of Claim 40, further comprising: 

performing DES Mata encryption standard encryption processing by the TCSM. 



44. (Currently Amended) The method of Claim 40, further comprising: 
providing a key to the TCSM by a sub-key generation component. 



'45. (Currently Amended) A router, comprising: 

means for providing a processor havmg an ALU for processing opcodes [op- 
codes] and a tightly coupled state machine (TG^SM) for performing encryption process- 
ing; 

means for reading data from a shared mem\>ry by either the ALU or the TCSM; 

means for transferring processing by an instkuction decode stage (ID stage) [the 
ALU], in response to reading an opcode [op-code], to the TCSM, and the TCSM per- 
forming encryption processing on data read from the shared memory; 

means for selecting as output results from the ALfcJ OR results from the TCSM. 

17 
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1 46. previously Presented) The apparatus of Claim 45, further comprising: 

2 \ means for using a multiplexer for selecting as output results from the ALU OR 

3 results ftpm the TCSM. 




47. (Previously Presented) The apparatus of Claim 45, further comprising; 

2 means for selecting by the ALU whether the ALU or the TCSM reads data from 

3 the memory. 



1 48. (Previously Presented) The apparatus of Claim 45, further comprising: 

2 means for performing DES o^ta encryption standard encryption processing by the 

3 TCSM. 



1 49. (Currently Amended) The apparatus of Claim 45, further comprising: 

2 means for providing a key to the TCSM b\ a sub-key generation component. 



1 y/50. (Currently Amendeo) A computer readable media, comprising: 

2 said computer readable media containing instructions for execution in a processor 

3 for the practice of the method of^ 
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providing encryption functions within a pipelined processor in a network switch, 

having the steps, 

associating a first set of opcodes with an ALU internal to the processo r, the ALU 
performing protocol processing operations ; 

associating a second set of opcodes with an encryption execution unit internal to 
the processo r, tne encryption execution unit performing encryption operations: 

[having an encryption tightly coupled state machine (TCSM), wherein protocol process- 
ing operations are pertbrmed by the ALU and encryption operations are performed by the 
encryption execution unk in response to said second set of opcodes; and] 

decoding opcodes by an instruction decode stage (ID stage); 

transferring by the ID stage, in response to an opcode from the first set of op- 
codes, processing to the ALU; \ 

transferring by the ID stage y [ALU], in response to an [op-code] opcode from 
said second set of opcodes , processing to the encryption execution unit 
[to process encryption operations in response to said second set of opcodes]; and 

selecting output from the ALU OR from the encryption execution unit. 



51. (Currently Amended) Electromagnetic signals propagating on a computer network, 
comprising: \ 

said electromagnetic signals carrying instructions for execution on a processor for 
the practice of the method of, \ 
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5 \ providing encryption functions within a pipelined processor in a network switch, 

6 having the steps, 

7 associating a first set of opcodes with an ALU internal to the processo r, the ALU 

8 performing protocol processing operations ; 

9 associating a second set of opcodes with an encryption execution unit internal to 

10 the processo r, thaencrvption execution unit performing encryption operations; 

i i [having an encryption tightly coupled state machine (TCSM), wherein protocol process- 

12 ing operations are performed by the ALU and encryption operations are performed by the 

13 encryption execution unk in response to said second set of opcodes; and] 

14 \ 

15 decoding opcodes by aa instruction decode stage (ID stage); 

16 transferring by the ID stage, in response to an opcode from the first set of op- 

17 codes, processing to the ALU; \ 

18 \ 

19 transferring by the ID stage [ALU], in response to an [op-code] opcode from 

20 said second set of opcodes , processing to the encryption execution unit 

21 [to process encryption operations in response to said second set of opcodes]; and 

22 \ 

23 selecting output from the ALU OR from the encryption execution unit. 

1 /52. (Currently Amended) A computer readable medik, comprising: 

2 said computer readable media containing instructions for execution in a processor 

3 for the practice of the method of operating a router, having the steps, 

4 [providing a processor having an ALU for]\ 

20 \ 
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5 processing opcodes by an instruction decode stage (ID stage): [and] 

6 \ [a tightly coupled state machine (TCSM) for] 

7 performing encryption processing by a tightly coupled state machine (TCSM) : 

8 performing protocol processing by an ALU: 

9 reading qata from a shared memory by either the ALU or the TCSM; 

10 transferring processing by the ID stage [ALU], in response to reading an opcode 
i i [op-code,] to the TC\SM, and the TCSM performing encryption processing on data read 

12 from the shared memVy; mid 

13 selecting as output results from the ALU OR results from the TCSM. 

1 /^3. (Previously Presented) Electromagnetic signals propagating on a computer network, 

2 comprising: \ 

3 said electromagnetic signals carrying instructions for execution on a processor for 

4 the practice of the method of operating a router, having the steps, 

5 [providing a processoXhaving an ALU for] 

6 processing opcodes [op-codes pby an instruction decode stage (ID sl^ e): [and] 

8 [a tightly coupled state maciune (TCSM) for] 

9 performing encryption processing by\a tightly coupled state machine (TCSM) : 

10 performing protocol processing by an ALU: 

i i reading data from a shared memory by either the ALU or the TCSM; 

12 transferring processing by the ID stage [ALU], in response to reading an opcode 

13 [op-code,] to the TCSM, and the TCSM performing encryption processing on data read 

14 from the shared memory; and \ 

15 selecting as output results from the ALU OR results from the TCSM. 
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